Session Fixation Risk Calculator

Rate session fixation and hijacking risk from identifier regeneration, entropy, transport acceptance, binding and timeout policy.

Inputs

Session identifier regeneration at login

Where session identifiers are accepted from

Session identifier entropybits

Binding to client context

Idle timeoutminutes

Absolute session lifetimehours

Privilege carried by the session

Overall Risk Severity

High

Likelihood Score

7.50/ 9

Impact Score

5.67/ 9

Attacker Usable Window

60minutes

Identifier Entropy

Adequate, but below the 128-bit modern baseline

Highest-Value Fix

Issue a new session identifier at login and invalidate the old one

Step by step

Values used
Session identifier regeneration at login = Same identifier kept across authentication — 9; Where session identifiers are accepted from = Cookie or URL parameter — 8; Session identifier entropy = 64 bits; Binding to client context = No binding — 9; Idle timeout = 60 minutes; Absolute session lifetime = 24 hours; Privilege carried by the session = Operator — 7
Session Fixation Risk
Likelihood = mean(regeneration at login, identifier acceptance, client binding, entropy score); impact = mean(session privilege, idle-timeout score, absolute-lifetime score).
Attacker window
usable window = min(idle timeout, absolute lifetime), the minutes a stolen identifier stays valid.
Overall Risk Severity
= High
Likelihood Score
= 7.50 / 9
Impact Score
= 5.67 / 9
Attacker Usable Window
= 60 minutes
Identifier Entropy
= Adequate, but below the 128-bit modern baseline
Highest-Value Fix
= Issue a new session identifier at login and invalidate the old one

How it works

Fixation depends on whether an attacker-chosen identifier survives the login, which is why regeneration and identifier acceptance dominate likelihood. Impact combines what the session can do with how long a stolen identifier keeps working, since both timeouts bound the attacker's window directly. If the identifier does not change at login, an attacker who plants one before authentication owns the authenticated session afterwards — no interception needed.

Formulas

Session Fixation Risk

Likelihood = mean(regeneration at login, identifier acceptance, client binding, entropy score); impact = mean(session privilege, idle-timeout score, absolute-lifetime score).

regeneration: 1 rotated and invalidated … 9 identifier survives login
entropyScore: 1 at ≥128 bits, 9 below 32 bits

Attacker window

usable window = min(idle timeout, absolute lifetime), the minutes a stolen identifier stays valid.

idle timeout: Inactivity before the session is dropped
absolute lifetime: Hard cap regardless of activity

Frequently Asked Questions

How is Session Fixation Risk calculated?

Likelihood = mean(regeneration at login, identifier acceptance, client binding, entropy score); impact = mean(session privilege, idle-timeout score, absolute-lifetime score). Fixation depends on whether an attacker-chosen identifier survives the login, which is why regeneration and identifier acceptance dominate likelihood. Impact combines what the session can do with how long a stolen identifier keeps working, since both timeouts bound the attacker's window directly.

Why does Session Fixation Risk matter?

If the identifier does not change at login, an attacker who plants one before authentication owns the authenticated session afterwards — no interception needed.

What values do I need to enter?

This calculator takes 7 inputs: Session identifier regeneration at login, Where session identifiers are accepted from, Session identifier entropy, Binding to client context, Idle timeout, Absolute session lifetime, Privilege carried by the session. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is binding a session to the IP address a good control?

It helps but it is not free. Mobile users change address constantly and corporate NAT puts thousands of users behind one address, so IP binding causes false logouts while barely inconveniencing an attacker on the same network. Prefer regeneration, short timeouts and a stable device signal.

You might also need

Cookie Security Calculator JWT Security Calculator API Authentication Strength Calculator